Lucene search

FortinetCVELIST:CVE-2020-29015

HistoryJan 14, 2021 - 4:07 p.m.

CVE-2020-29015

2021-01-1416:07:20

fortinet

www.cve.org

fortiweb

sql injection

vulnerability

remote attacker

authorization header

AI Score

Confidence

High

EPSS

0.001

Percentile

48.4%

JSON

A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement.

CNA Affected

[
  {
    "product": "Fortinet FortiWeb",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4"
      }
    ]
  }
]

References

www.fortiguard.com/psirt/FG-IR-20-124